@mnemonik/cli 7.131.1 → 7.132.0

package/dist/router.d.ts

@@ -10,6 +10,8 @@ import { type InstallSessionTransport } from './installSession.js';
 import { type ProjectExecutor, type ProjectReadTransport } from './project.js';
 import { type ReadinessCondition, resolveProjectIdentity } from '@mnemonik/shared';
 import { type ClaudeCodeStoreOptions } from './auth/claudeCodeSignIn.js';
+import { type CodexStoreOptions } from './auth/codexAuthorization.js';
+import { type CursorStoreOptions } from './auth/cursorAuthorization.js';
 import { type EditorLoginOverrides } from './auth/pkce.js';
 import { type ScannerPickerResult } from './scanner/picker.js';
 import { type InstallDependencies } from './install/transaction.js';
@@ -29,16 +31,10 @@ export declare const SCANNER_REMOVED_LINE = "Background indexing removed from th
 export declare const dataDeletePrompt: (projectId: string) => string;
 export declare const stillWatchedLine: (root: string) => string;
 export declare const identityFileKeptLine = "This folder's .mnemonik.json still points at the deleted project. Connecting the folder again creates a new project.";
-export declare const CODEX_SIGNED_IN_MESSAGE = "Codex is signed in to Mnemonik.";
-/** An editor signed in on another of the person's machines (L-182). */
-export declare const signedInElsewhereMessage: (editor: string) => string;
-/** A coding tool with a valid sign-in on this machine; `mnemonik connect` has nothing to do. */
-export declare const alreadySignedInMessage: (editor: string, lastUsedAt: string | null, refreshable?: boolean) => string;
-/** The coding tool itself holds no Mnemonik sign-in it can use on this machine. */
-export declare const notSignedInHereMessage: (editor: string) => string;
+export declare const CODEX_SIGNED_IN_MESSAGE = "Codex MCP: authorized.";
 /** For the agent running `connect --json`: what to do with the link it was given. */
-export declare const SIGN_IN_LINK_REASON = "Give this link to the person to approve the Codex sign-in. This command finishes when they do.";
-export declare const CONNECT_NOT_APPROVED_MESSAGE = "Sign-in timed out. Run mnemonik connect codex to try again.";
+export declare const SIGN_IN_LINK_REASON = "Give this link to the person to authorize Codex MCP. This command finishes when they do.";
+export declare const CONNECT_NOT_APPROVED_MESSAGE = "Codex MCP was not authorized in time. Run mnemonik connect codex to try again.";
 export declare function maintenanceExitCode(results: readonly Pick<HostResult, 'status'>[]): number;
 export declare const help: string;
 export interface CliDependencies {
@@ -87,8 +83,12 @@ export interface CliDependencies {
     statusDetails?: StatusDocumentInput['details'];
     codexTrustConditions?: () => Promise<readonly ReadinessCondition[]>;
     diagnostics?: DiagnosticsDependencies;
-    /** Where Claude Code's own stored sign-in is read: this platform, environment and Keychain by default. */
+    /** Where Claude Code's own stored authorization is read: this platform, environment and Keychain by default. */
     claudeCodeStore?: Omit<ClaudeCodeStoreOptions, 'home'>;
+    /** Where Codex's own stored authorization is read: this platform and environment by default. */
+    codexStore?: Omit<CodexStoreOptions, 'home'>;
+    /** Where Cursor's own stored authorization is read: this platform, environment and node:sqlite by default. */
+    cursorStore?: Omit<CursorStoreOptions, 'home'>;
 }
 export declare function runCli(args: string[], deps?: CliDependencies): Promise<number>;
 //# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAU5F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAML,KAAK,gBAAgB,EAErB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAiD,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGpG,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAiC,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAML,KAAK,kBAAkB,EACvB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEjG,OAAO,EAAsC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG/F,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAgBL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAErB,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAA8C,CAAC;AAClG,eAAO,MAAM,kBAAkB,SAAU,MAAM,KAAG,MACiB,CAAC;AACpE,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAkC,CAAC;AACtF,eAAO,MAAM,0BAA0B,SAAU,MAAM,KAAG,MACT,CAAC;AAClD,eAAO,MAAM,iBAAiB,SAAU,MAAM,KAAG,MAA+C,CAAC;AACjG,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG,MACkD,CAAC;AACzG,eAAO,MAAM,kBAAkB,SAAU,MAAM,KAAG,MAA4B,CAAC;AAC/E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAIM,CAAC;AAC5C,eAAO,MAAM,oBAAoB,mDAAmD,CAAC;AAwErF,eAAO,MAAM,gBAAgB,cAAe,MAAM,KAAG,MAC6D,CAAC;AACnH,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MACgC,CAAC;AACjF,eAAO,MAAM,oBAAoB,yHACuF,CAAC;AACzH,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AACzE,uEAAuE;AACvE,eAAO,MAAM,wBAAwB,WAAY,MAAM,WACsB,CAAC;AAC9E,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,WACzB,MAAM,cACF,MAAM,GAAG,IAAI,kCAK2B,CAAC;AACvD,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,WAAY,MAAM,WACO,CAAC;AAC7D,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,mGACkE,CAAC;AACnG,eAAO,MAAM,4BAA4B,gEACsB,CAAC;AAEhE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,GAAG,MAAM,CAG1F;AAiMD,eAAO,MAAM,IAAI,QAAuB,CAAC;AAwLzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE;QAAE,sBAAsB,EAAE,OAAO,sBAAsB,CAAA;KAAE,CAAC;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;IAC1B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,OAAO,CAAC,EAAE;QACR,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACrE,YAAY,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,6GAA6G;IAC7G,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnD,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,qBAAqB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACpE,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,0GAA0G;IAC1G,eAAe,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;CACxD;AAuqCD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4pCxF"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAU5F,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAML,KAAK,gBAAgB,EAErB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAiD,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGpG,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAiC,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAKL,KAAK,kBAAkB,EACvB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAKnG,OAAO,EAAsC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG/F,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAiBL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAErB,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAA8C,CAAC;AAClG,eAAO,MAAM,kBAAkB,SAAU,MAAM,KAAG,MACiB,CAAC;AACpE,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAkC,CAAC;AACtF,eAAO,MAAM,0BAA0B,SAAU,MAAM,KAAG,MACT,CAAC;AAClD,eAAO,MAAM,iBAAiB,SAAU,MAAM,KAAG,MAA+C,CAAC;AACjG,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG,MACkD,CAAC;AACzG,eAAO,MAAM,kBAAkB,SAAU,MAAM,KAAG,MAA4B,CAAC;AAC/E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAIM,CAAC;AAC5C,eAAO,MAAM,oBAAoB,mDAAmD,CAAC;AAwErF,eAAO,MAAM,gBAAgB,cAAe,MAAM,KAAG,MAC6D,CAAC;AACnH,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MACgC,CAAC;AACjF,eAAO,MAAM,oBAAoB,yHACuF,CAAC;AACzH,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAChE,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,6FAC4D,CAAC;AAC7F,eAAO,MAAM,4BAA4B,mFACyC,CAAC;AAEnF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,GAAG,MAAM,CAG1F;AAiMD,eAAO,MAAM,IAAI,QAAuB,CAAC;AAwLzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE;QAAE,sBAAsB,EAAE,OAAO,sBAAsB,CAAA;KAAE,CAAC;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;IAC1B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,OAAO,CAAC,EAAE;QACR,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACrE,YAAY,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,6GAA6G;IAC7G,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnD,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,qBAAqB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACpE,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,gHAAgH;IAChH,eAAe,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IACvD,gGAAgG;IAChG,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC7C,8GAA8G;IAC9G,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;CAChD;AA6tCD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwqCxF"}

package/dist/router.js

@@ -7359,19 +7359,6 @@ function apiOrigin(env = process.env) {
   return new URL(env.MNEMONIK_API_RESOURCE || "https://api.mnemonik.dev").origin;
 }
 
-// packages/shared/dist/grantHost.js
-var CODING_TOOL_SIGN_IN = {
-  "claude-code": {
-    kind: "in_tool",
-    step: "In Claude Code, type /mcp, choose mnemonik, then Authenticate."
-  },
-  codex: { kind: "connect" },
-  cursor: {
-    kind: "in_tool",
-    step: "In Cursor, open Cursor Settings, Customize, MCPs, then Authenticate."
-  }
-};
-
 // packages/local-setup/dist/storage.js
 init_hookRuntime();
 init_hookRuntime();
@@ -7728,15 +7715,20 @@ import {
 import { evaluateRoot } from "./project/eligibility.js";
 import { accountActions } from "./transport/server.js";
 import {
-  codingToolSignIn,
   grantTransport,
   grantHost,
   grantSummaryLines,
-  relativeTime,
-  validGrant,
-  withStoredSignIn
+  mcpAuthorization,
+  serverAuthorization,
+  validGrant
 } from "./auth/status.js";
-import { claudeCodeStoredSignIn } from "./auth/claudeCodeSignIn.js";
+import {
+  claudeCodeStoredAuthorization
+} from "./auth/claudeCodeSignIn.js";
+import { codexStoredAuthorization } from "./auth/codexAuthorization.js";
+import { cursorStoredAuthorization } from "./auth/cursorAuthorization.js";
+import { authorizeStep, mcpLine, storeNote } from "./authorizationWords.js";
+import { installationEmail } from "./installation.js";
 import { createCliAuth } from "./auth/index.js";
 import { OAuthProtocolError, runEditorLogin } from "./auth/pkce.js";
 import { currentInstallSession, ensureInstallSession } from "./auth/installSession.js";
@@ -7750,18 +7742,19 @@ import {
 import { chooseHostProfile, simulatedInstall, terminalInstallUI } from "./install/ui.js";
 import {
   CODEX_TRUST_MESSAGE,
-  codingToolLines,
+  authorizationEntries,
   codingToolStatuses,
   collectStatusDocument,
+  hookAuthorizations,
   installedCodingTools,
   localEditorStatus,
   localInstallationConditions,
   mcpTurnOnAction,
   renderStatusSummaries,
   renderRefusals,
-  renewsMessage,
   REPORT_NOT_SENT,
   renderScannerFailure,
+  scannerAuthorization,
   statusExitCode,
   withCodingTools
 } from "./status.js";
@@ -7827,12 +7820,9 @@ async function uninstallScannerOptOut(deps, output, service, json) {
 var dataDeletePrompt = (projectId) => `This deletes everything background indexing has sent for ${projectId} from your account. Type yes to continue.`;
 var stillWatchedLine = (root) => `The folder is still being indexed. Run mnemonik remove ${root} to stop that.`;
 var identityFileKeptLine = "This folder's .mnemonik.json still points at the deleted project. Connecting the folder again creates a new project.";
-var CODEX_SIGNED_IN_MESSAGE = "Codex is signed in to Mnemonik.";
-var signedInElsewhereMessage = (editor) => `${editor} is already signed in to Mnemonik from another of your machines.`;
-var alreadySignedInMessage = (editor, lastUsedAt, refreshable = false) => `${editor} is already signed in to Mnemonik on this computer${lastUsedAt ? `, last used ${relativeTime(Date.parse(lastUsedAt), Date.now())}` : ""}.${refreshable ? ` ${renewsMessage(editor)}` : ""}`;
-var notSignedInHereMessage = (editor) => `${editor} is not signed in to Mnemonik on this computer.`;
-var SIGN_IN_LINK_REASON = "Give this link to the person to approve the Codex sign-in. This command finishes when they do.";
-var CONNECT_NOT_APPROVED_MESSAGE = "Sign-in timed out. Run mnemonik connect codex to try again.";
+var CODEX_SIGNED_IN_MESSAGE = "Codex MCP: authorized.";
+var SIGN_IN_LINK_REASON = "Give this link to the person to authorize Codex MCP. This command finishes when they do.";
+var CONNECT_NOT_APPROVED_MESSAGE = "Codex MCP was not authorized in time. Run mnemonik connect codex to try again.";
 function maintenanceExitCode(results) {
   if (results.some((result) => result.status === "FAILED")) return 1;
   return results.every((result) => result.status === "READY") ? 0 : 3;
@@ -8707,38 +8697,68 @@ async function installCommand(parsed, deps, output) {
 function refusalStateDir(deps) {
   return deps.projectStateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
 }
-var claudeCodeStored = (deps) => claudeCodeStoredSignIn({ home: deps.home ?? homedir4(), ...deps.claudeCodeStore });
-async function codingToolSignIns(deps, output, hosts) {
-  if (!hosts.length) return /* @__PURE__ */ new Map();
+async function storedAuthorizations(deps, hosts) {
+  const home = deps.home ?? homedir4();
+  const readers = {
+    "claude-code": () => claudeCodeStoredAuthorization({ home, ...deps.claudeCodeStore }),
+    codex: () => codexStoredAuthorization({ home, ...deps.codexStore }),
+    cursor: () => cursorStoredAuthorization({ home, ...deps.cursorStore })
+  };
+  return new Map(
+    await Promise.all(
+      hosts.map(async (host) => [host, await readers[host]().catch(() => void 0)])
+    )
+  );
+}
+async function authorizationEvidence(deps, output, hosts) {
   const [server, stored] = await Promise.all([
-    serverSignIns(deps, output, hosts),
-    hosts.includes("claude-code") ? claudeCodeStored(deps) : void 0
+    serverAuthorizations(deps, output, hosts),
+    storedAuthorizations(deps, hosts)
   ]);
-  if (!stored) return server;
-  const result = new Map(server ?? []);
-  const claudeCode = withStoredSignIn(server?.get("claude-code"), stored);
-  if (claudeCode) result.set("claude-code", claudeCode);
-  else result.delete("claude-code");
-  return server || claudeCode ? result : void 0;
+  const problem = server.cli.state === "locked" ? "cli_locked" : server.cli.state === "not_signed_in" || server.cli.state === "signed_out" ? "cli_not_signed_in" : "unreachable";
+  return {
+    cli: server.cli,
+    mcp: new Map(
+      hosts.map((host) => [
+        host,
+        mcpAuthorization(server.tools?.get(host), stored.get(host), problem)
+      ])
+    )
+  };
 }
-async function serverSignIns(deps, output, hosts) {
-  const bearer = await auth(deps, output, false).getCliBearer().catch(() => void 0);
-  if (typeof bearer !== "string") return void 0;
+async function serverAuthorizations(deps, output, hosts) {
+  const bearer = await auth(deps, output, false).getCliBearer().catch(
+    (error) => isCredentialSessionUnavailableError(error) ? "locked" : void 0
+  );
+  if (bearer === "locked") return { cli: { state: "locked" } };
+  if (typeof bearer !== "string")
+    return {
+      cli: {
+        state: bearer?.reason === "family_missing" ? "not_signed_in" : bearer?.status === "ACTION_REQUIRED" ? "signed_out" : "unconfirmed"
+      }
+    };
+  if (!hosts.length)
+    return {
+      cli: {
+        state: "signed_in",
+        email: await installationEmail(
+          deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
+        )
+      }
+    };
   const send = deps.grantFetch ?? globalThis.fetch;
   const grants = grantTransport(
     async () => bearer,
     (url, options) => send(url, { ...options, signal: AbortSignal.timeout(2500) })
   );
   const here = await grants.list({ here: true }).catch(() => void 0);
-  if (!here) return void 0;
-  const result = new Map(
-    hosts.map((host) => [host, codingToolSignIn(host, here)])
-  );
-  if ([...result].some(([host, signIn]) => host === "cursor" && signIn.state !== "signed_in")) {
+  if (!here) return { cli: { state: "unconfirmed" } };
+  const tools = new Map(hosts.map((host) => [host, serverAuthorization(host, here)]));
+  if ([...tools].some(([host, found]) => host === "cursor" && found.state !== "authorized")) {
     const everywhere = await grants.list().catch(() => void 0);
-    if (everywhere) result.set("cursor", codingToolSignIn("cursor", here, everywhere));
+    if (everywhere) tools.set("cursor", serverAuthorization("cursor", here, everywhere));
   }
-  return result;
+  return { cli: { state: "signed_in", email: here.email ?? null }, tools };
 }
 async function doctorCommand(parsed, deps, output) {
   const invalid = allowed(parsed, []);
@@ -9364,42 +9384,59 @@ Preview: ${preview.path}
       output,
       parsed.flags.has("json") ? void 0 : (line) => output.line(line)
     );
-    const editors = await installedCodingTools(
-      deps.home ?? homedir4(),
-      deps.hostManagement?.stateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
-    );
-    const shown = withCodingTools(
-      document,
-      codingToolStatuses(
-        editors,
-        document.conditions ?? [],
-        await codingToolSignIns(
-          deps,
-          output,
-          editors.map((editor) => editor.host).filter(
-            (host) => hostOrder.includes(host)
-          )
-        )
+    const stateDir = deps.hostManagement?.stateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
+    const editors = await installedCodingTools(deps.home ?? homedir4(), stateDir);
+    const evidence = await authorizationEvidence(
+      deps,
+      output,
+      editors.map((editor) => editor.host).filter(
+        (host) => hostOrder.includes(host)
       )
     );
+    const tools = codingToolStatuses(
+      editors,
+      document.conditions ?? [],
+      evidence.mcp,
+      await hookAuthorizations(stateDir, editors)
+    );
+    const scanner = await scannerAuthorization(
+      deps.projectStateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
+    );
+    const shown = withCodingTools(document, tools, evidence.mcp, scanner);
+    const authorizations = authorizationEntries({
+      tools,
+      mcp: evidence.mcp,
+      conditions: shown.conditions ?? [],
+      scanner,
+      cli: evidence.cli
+    });
     const version = await packageVersion();
     const store = new RuntimeStore(
       deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
     );
     if (!parsed.flags.has("json")) {
       renderStatusSummaries(shown, output, { agent: !personPresent(parsed, deps) });
-      for (const line of codingToolLines(shown.codingTools)) output.line(line);
+      for (const entry of authorizations)
+        if (entry.component === "cli" && entry.state === "signed_in")
+          output.cliSignedIn(entry.email);
+        else output.line(entry.line);
       await renderRefusals(refusalStateDir(deps), output);
     }
     const hint = await cliUpdateHint(store, version);
     if (parsed.flags.has("json"))
-      output.json({ ...shown, cli: { version, ...hint ? { updateAvailable: hint } : {} } });
+      output.json({
+        ...shown,
+        // The account is shown to the person only; JSON stays free of it.
+        authorizations: authorizations.map(
+          (entry) => entry.component === "cli" && entry.state === "signed_in" ? { component: "cli", state: "signed_in", line: "CLI: signed in." } : entry
+        ),
+        cli: { version, ...hint ? { updateAvailable: hint } : {} }
+      });
     else if (hint) output.line(hint);
     const reported = await reportCurrentInstallation(deps, output, document);
-    if (reported === "signed_out" && !parsed.flags.has("json")) {
+    if (reported === "signed_out" && !parsed.flags.has("json"))
       output.line(REPORT_NOT_SENT.sentence);
-      output.line(REPORT_NOT_SENT.nextStep);
-    } else if (typeof reported === "object" && !parsed.flags.has("json"))
+    else if (typeof reported === "object" && !parsed.flags.has("json"))
       output.line(humanReason(reported.refused));
     return statusExitCode(shown);
   }
@@ -9412,28 +9449,17 @@ Preview: ${preview.path}
     const editor = (await localEditorStatus(deps.home ?? homedir4())).find(
       (candidate) => candidate.host === host
     );
-    const signIn = editor?.mcp === "ready" ? await codingToolSignIns(deps, output, [host]) : void 0;
-    const current = signIn?.get(host);
-    if (current?.state === "signed_in" || current?.state === "signed_in_elsewhere") {
-      const message = current.state === "signed_in_elsewhere" ? signedInElsewhereMessage(launchHostLabels[host]) : alreadySignedInMessage(
-        launchHostLabels[host],
-        current.lastUsedAt,
-        current.stored?.state === "refreshable"
-      );
-      if (parsed.flags.has("json"))
-        output.json(
-          current.state === "signed_in" ? {
-            status: "READY",
-            signIn: current.state,
-            lastUsedAt: current.lastUsedAt,
-            ...current.stored ? { stored: current.stored } : {},
-            reason: message
-          } : { status: "READY", reason: message }
-        );
-      else output.line(message);
+    const tool = launchHostLabels[host];
+    const mcp = editor?.mcp === "ready" ? (await authorizationEvidence(deps, output, [host])).mcp.get(host) : void 0;
+    const json = parsed.flags.has("json");
+    if (mcp && ["authorized", "authorized_elsewhere", "store_unchecked", "server_unchecked"].includes(
+      mcp.state
+    )) {
+      const line = mcpLine(tool, host, mcp);
+      if (json) output.json({ status: "READY", reason: line, mcp });
+      else output.line(line);
       return 0;
     }
-    const json = parsed.flags.has("json");
     if (host === "codex" && editor?.mcp === "ready") {
       const bearer = await auth(deps, output, false).getCliBearer().catch(() => void 0);
       if (typeof bearer === "string") {
@@ -9467,17 +9493,11 @@ Preview: ${preview.path}
         }
       }
     }
-    const reason = editor?.mcp === "disabled" ? `${editor.name} connection is turned off.` : editor?.mcp === "ready" ? current?.stored?.state === "missing" ? notSignedInHereMessage(launchHostLabels[host]) : "Finish signing in to Mnemonik in the coding tool." : `${launchHostLabels[host]} connection is missing.`;
+    const reason = editor?.mcp === "disabled" ? `${tool} MCP: turned off.` : editor?.mcp === "ready" && mcp ? mcpLine(tool, host, mcp, false) : `${tool} MCP: not set up on this computer.`;
     const actions = editor?.mcp === "ready" ? editorAuthorizationRows([host]) : [
       editor?.mcp === "disabled" ? mcpTurnOnAction[host] : "Run mnemonik install to set it up again."
     ];
-    if (parsed.flags.has("json"))
-      output.json({
-        status: "ACTION_REQUIRED",
-        reason,
-        actions,
-        ...current?.stored ? { stored: current.stored } : {}
-      });
+    if (json) output.json({ status: "ACTION_REQUIRED", reason, actions, ...mcp ? { mcp } : {} });
     else {
       output.line(reason);
       for (const action of actions) output.line(action);
@@ -9847,27 +9867,38 @@ Preview: ${preview.path}
         return (!grantHostName || hostOrder.includes(grantHostName)) && (!host || grantHostName === host);
       }).map((g) => ({ ...g, host: grantHost(g) ?? g.clientName ?? g.clientId }));
       const signedIn = grants.filter(validGrant);
-      const stored = !host || host === "claude-code" ? await claudeCodeStored(deps) : void 0;
+      const tools = hostOrder.filter((tool) => !host || tool === host);
+      const stored = await storedAuthorizations(deps, tools);
+      const storedJson = Object.fromEntries(
+        [...stored].filter((entry) => !!entry[1])
+      );
       if (parsed.flags.has("json"))
         output.json({
           account: status.account,
           grants,
-          ...stored ? { stored: { "claude-code": stored } } : {}
+          ...Object.keys(storedJson).length ? { stored: storedJson } : {}
         });
       else if (!signedIn.length)
         output.line(
-          host ? `${launchHostLabels[host]} is not signed in.` : humanReason("not_signed_in")
+          host ? `${launchHostLabels[host]} MCP: not authorized on any of your computers.` : humanReason("not_signed_in")
         );
       else {
-        output.signedInAs(status.email);
-        const signInStep = CODING_TOOL_SIGN_IN["claude-code"];
-        const claudeCode = (summary2) => stored?.state === "missing" ? `not signed in on this computer.${"step" in signInStep ? ` ${signInStep.step}` : ""}` : stored?.state === "refreshable" ? `${summary2}. ${renewsMessage("Claude Code")}` : summary2;
-        for (const line of grantSummaryLines(signedIn, launchHostLabels, Date.now(), {
-          "claude-code": claudeCode
-        }))
+        output.cliSignedIn(status.email);
+        const onThisComputer = (tool) => (summary2) => {
+          const here = stored.get(tool);
+          const note = storeNote(launchHostLabels[tool], here);
+          if (!note) return summary2;
+          return `${summary2}. ${note}${here?.state === "missing" ? ` ${authorizeStep(tool)}` : ""}`;
+        };
+        for (const line of grantSummaryLines(
+          signedIn,
+          launchHostLabels,
+          Date.now(),
+          Object.fromEntries(tools.map((tool) => [tool, onThisComputer(tool)]))
+        ))
           output.line(line);
         output.line(
-          "Older sign-ins stay valid until `mnemonik auth logout`. `mnemonik auth status --json` lists every one."
+          "These are your account's authorizations on all your computers. Older ones stay valid until `mnemonik auth logout`, and `mnemonik auth status --json` lists every one."
         );
       }
       return 0;
@@ -9913,19 +9944,16 @@ export {
   SCANNER_UNINSTALL_PROMPT,
   SIGN_IN_LINK_REASON,
   alreadyConnectedFolderLine,
-  alreadySignedInMessage,
   connectFolderPrompt,
   connectedFolderLine,
   dataDeletePrompt,
   help,
   identityFileKeptLine,
   maintenanceExitCode,
-  notSignedInHereMessage,
   projectDeletedLine,
   projectDeletionWarning,
   removeFolderPrompt,
   removedFolderLine,
   runCli,
-  signedInElsewhereMessage,
   stillWatchedLine
 };